a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8

General

Target

a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Size

32KB
MD5

c7e2a311a5ca80ba57a1627cf4b147ac
SHA1

171e4136d2547248cac6170dc7a8b9cfc9bd62f2
SHA256

a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8
SHA512

1ea1d9806b7aa7dbc370c544c4e82dfc28750558c9f450c81bdc8365d61557486a7bbde13adc423ad799efbd841a396cd5939a04a9fbfa257a8307dd5688c3a4
SSDEEP

384:PQXWtTyg1fJDMVD9ORAtKT5KDBUdrZw7QSc:PgSyg9JwSRGC5eBUrZr

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exea6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

k4.exek4.exe

pid process

1212 k4.exe
1212 k4.exe

pid	process
1212	k4.exe
1212	k4.exe

Loads dropped DLL 2 IoCs

Processes:

a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exea6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe

pid	process
1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exea6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exea6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe

pid	process
1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exea6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe

description	pid	process	target process
PID 1968 wrote to memory of 1212	1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe	k4.exe
PID 1968 wrote to memory of 1212	1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe	k4.exe
PID 1968 wrote to memory of 1212	1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe	k4.exe
PID 1968 wrote to memory of 1212	1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe	k4.exe
PID 1968 wrote to memory of 1212	1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe	k4.exe
PID 1968 wrote to memory of 1212	1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe	k4.exe
PID 1968 wrote to memory of 1212	1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe	k4.exe
PID 1968 wrote to memory of 1212	1968	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe	k4.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exea6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe

C:\Users\Admin\AppData\Local\Temp\a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
"C:\Users\Admin\AppData\Local\Temp\a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1968

C:\Users\Public\Documents\k4.exe
C:/Users/Public/Documents/k4.exe
2⤵
- Executes dropped EXE
PID:1212

C:\Users\Public\Documents\k4.exe
C:/Users/Public/Documents/k4.exe /D
2⤵
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /t /im k4.exe
2⤵
PID:272

C:\Users\Admin\AppData\Local\Temp\a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe
"C:\Users\Admin\AppData\Local\Temp\a6941755e5b2bd44d696020e8c058581380aa75a1c594bf48e6c2512863b06e8.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1968

C:\Users\Public\Documents\k4.exe
C:/Users/Public/Documents/k4.exe
2⤵
- Executes dropped EXE
PID:1212

C:\Users\Public\Documents\k4.exe
C:/Users/Public/Documents/k4.exe /D
2⤵
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /t /im k4.exe
2⤵
PID:272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
640KB

MD5
80d9afafe5da8c0a44d9f127ec6161fd

SHA1
dcf4d8332464b8594f7685a6010ca41bb1a7ae71

SHA256
4c97da1cc9d03b0278a192d84d305bf7a16dbfa37c082d80c368460d6925a7c8

SHA512
a6426d674706125f9a131af463b9e4fb1fc050119775d154356a2c2cd040ff97eb825b6070feae6e205b11eb77c3efcb65b8c2fd09b1a7b8ea705603b17d6a81

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
640KB

MD5
80d9afafe5da8c0a44d9f127ec6161fd

SHA1
dcf4d8332464b8594f7685a6010ca41bb1a7ae71

SHA256
4c97da1cc9d03b0278a192d84d305bf7a16dbfa37c082d80c368460d6925a7c8

SHA512
a6426d674706125f9a131af463b9e4fb1fc050119775d154356a2c2cd040ff97eb825b6070feae6e205b11eb77c3efcb65b8c2fd09b1a7b8ea705603b17d6a81

Download Submit
\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
memory/1212-58-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1212-56-0x0000000000000000-mapping.dmp

Download
memory/1212-58-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1212-56-0x0000000000000000-mapping.dmp

Download
memory/1892-60-0x0000000000000000-mapping.dmp

Download
memory/1892-60-0x0000000000000000-mapping.dmp

Download
memory/1968-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1968-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads